Method and system for controlling electrical systems of vehicles

ABSTRACT

Methods and systems are provided for controlling an electrical system of a vehicle. Sensors are used to obtain first data for a first path of calculations and second data for a second path of calculations. The first path comprises a first plurality of calculations of generating a value of a parameter pertaining to the electrical system, and the second path comprises a second plurality of calculations of monitoring the electrical system with respect to the first path. A processor is coupled to the plurality of sensors, and is configured to determine whether a data frozen flag is active, perform the first plurality of calculations of the first path using the first data if the first data flag is inactive, and perform the second plurality of calculations of the second path if the first data flag is active.

TECHNICAL FIELD

The present invention generally relates to vehicles and, moreparticularly, relates to a method and system for controlling electricalsystems of vehicles.

BACKGROUND OF THE INVENTION

In recent years, advances in technology, as well as ever-evolving tastesin style, have led to substantial changes in the design of automobiles.One of the changes involves the complexity of the electrical and drivesystems within automobiles, particularly alternative fuel vehicles, suchas hybrid, battery electric, and fuel cell vehicles. Such alternativefuel vehicles typically use one or more electric motors, perhaps incombination with another actuator, to drive the wheels.

Such vehicles typically include a vehicle propulsion system havingmultiple components that contribute to the propulsion of the vehicle.These components can be further grouped into subsystems, such as thedrivetrain, the internal combustion engine, and the hybrid electricdrive system. The electric drive system typically includes multiplecomponents including sensors, energy storage, electronic inverters,electric motors, and a control system. To ensure the operating integrityof the electric drive system, a multi-layer monitoring system may beused to ensure that the output of the electric drive (torque, speed,etc.) is as requested, or possibly in the case of a fault situation, asdelivered.

A commonly employed first layer monitoring system performs diagnosticson all sensor inputs. Such low level diagnostics may include, but arenot limited to, checking whether a sensor is able to communicate orchecking to see if a sensor reading is in its expected or allowableoperating range. Such sensors may include current sensors, voltagesensors, position sensors, speed sensors, temperature sensors, physicaland/or virtual software replacements, and the like.

A second layer monitoring system may perform monitoring on the controlsystem to ensure that it is producing outputs as intended. Such a secondlayer monitoring system will typically monitor the entire control systemfrom input to output or by monitoring the individual components of thecontrol system separately to determine the integrity of the overallcontrol system. For example, a second layer monitoring system can beused to verify that the correct outputs are produced for the giveninputs in order to detect errors in the computational processors,memory, and data storage. A conventional method for checking the dutycycles is to essentially perform an entire redundant calculation.However, such a calculation demands considerable processing power andmemory.

Accordingly, it is desirable to provide a method and system forcontrolling electrical systems of vehicles. Furthermore, other desirablefeatures and characteristics of the present invention will becomeapparent from the subsequent description taken in conjunction with theaccompanying drawings and the foregoing technical field and background.

SUMMARY

In accordance with an exemplary embodiment, a method for controlling anelectrical system of a vehicle using first data for a first path ofcalculations and second data for a second path of calculations isprovided. The first path comprises a first plurality of calculations ofgenerating a value of a parameter pertaining to the electrical system,and the second path comprises a second plurality of calculations ofmonitoring the electrical system with respect to the first path. Themethod comprises the steps of determining whether the first data isready for processing along the first path using a processor, performingcalculations of the first path using the first data and the processor,and performing calculations of the second path using the processor andthe second data if the first data is not ready for processing along thefirst path.

In accordance with another exemplary embodiment, a method forcontrolling an electrical system of a vehicle using control data for acontrol path of a first plurality of calculations of the electricalsystem and monitoring data for a monitoring path of a second pluralityof calculations for monitoring the control path is provided. The methodcomprises the steps of determining whether a plurality of data frozenflags are active using a processor, each of the plurality of data frozenflags corresponding to a respective one of the first plurality ofcalculations of the first path and a respective one of the secondplurality of calculations of the second path, performing those of thefirst plurality of calculations for which the corresponding data frozenflag is inactive using the processor, performing those of the secondplurality of calculations for which the corresponding data frozen flagis active using the processor, storing results of the second pluralityof calculations upon completion of the second plurality of calculations,and setting the data frozen flag to inactive using the processor uponcompletion of the second plurality of calculations.

In accordance with a further exemplary embodiment, a system forcontrolling an electrical system of a vehicle is provided. The systemcomprises a plurality of sensors and a processor. The plurality ofsensors are used to obtain first data for a first path of calculationsand second data for a second path of calculations. The first pathcomprises a first plurality of calculations of generating a value of aparameter pertaining to the electrical system, and the second pathcomprises a second plurality of calculations of monitoring theelectrical system with respect to the first path. The processor iscoupled to the plurality of sensors, and is configured to determinewhether a data frozen flag is active, perform the first plurality ofcalculations of the first path using the first data if the first dataflag is inactive, and perform the second plurality of calculations ofthe second path if the first data flag is active.

DESCRIPTION OF THE DRAWINGS

The present invention will hereinafter be described in conjunction withthe following drawing figures, wherein like numerals denote likeelements, and

FIG. 1 is a schematic view of an exemplary vehicle, such as anautomobile, in accordance with an exemplary embodiment;

FIG. 2 is a functional block diagram of a motor control system andmethod for a vehicle, such as the vehicle of FIG. 1, in accordance withan exemplary embodiment;

FIG. 3 is a graph of an exemplary sampling of data from an electroniccontrol system over time, and that can be used in connection with thevehicle of FIG. 1 and the motor control system and method of FIG. 2, inaccordance with an exemplary embodiment;

FIG. 4 is a flowchart of a process for controlling electrical systems ofvehicles, and that can be used in connection with the vehicle of FIG. 1and the motor control system and method of FIG. 2 and in implementingthe data sampling of FIG. 3, in accordance with an exemplary embodiment;and

FIG. 5 is a functional block diagram of a hierarchy for the process ofFIG. 4, and that can be used in connection with the vehicle of FIG. 1,the motor control system and method of FIG. 2 and the implementation ofthe data sampling of FIG. 3, in accordance with an exemplary embodiment.

DESCRIPTION OF AN EXEMPLARY EMBODIMENT

The following detailed description is merely exemplary in nature and isnot intended to limit the invention or the application and uses of theinvention. Furthermore, there is no intention to be bound by anyexpressed or implied theory presented in the preceding technical field,background, and brief summary, or the following detailed description.

The following description refers to elements or features being“connected” or “coupled” together. As used herein, “connected” may referto one element/feature being mechanically joined to (or directlycommunicating with) another element/feature, and not necessarilydirectly. Likewise, “coupled” may refer to one element/feature beingdirectly or indirectly joined to (or directly or indirectlycommunicating with) another element/feature, and not necessarilymechanically. However, it should be understood that although twoelements may be described below, in one embodiment, as being“connected,” in alternative embodiments similar elements may be“coupled,” and vice versa. Thus, although the schematic diagrams shownherein depict example arrangements of elements, additional interveningelements, devices, features, or components may be present in an actualembodiment.

Further, various components and features described herein may bereferred to using particular numerical descriptors, such as first,second, third, etc., as well as positional and/or angular descriptors,such as horizontal and vertical. However, such descriptors may be usedsolely for descriptive purposes relating to drawings and should not beconstrued as limiting, as the various components may be rearranged inother embodiments. It should also be understood that FIGS. 1-4 aremerely illustrative and may not be drawn to scale.

FIGS. 1-4 illustrate a method and system for controlling an automotiveelectrical system. The electrical system includes a power electronicsunit (e.g., a direct current-to-alternating current (DC/AC) inverter ora direct current-to-direct current (DC/DC) converter) with one or morepower switches or transistors. First and second voltage commandscorresponding to respective first and second components of a commandedvoltage vector on a synchronous frame of reference coordinate system arereceived. A plurality of duty cycles for operating the at least oneswitch are calculated based on the first and second voltage commands.First and second actual voltages are calculated based on the pluralityof duty cycles. The first and second actual voltages correspond torespective first and second components of an actual voltage vector onthe synchronous frame of reference coordinate system. An indication of afault is generated based on the difference between the first componentof the commanded voltage vector and the first component of the actualvoltage vector and the difference between the second component of thecommanded voltage vector and the second component of the actual voltagevector. The electrical system also preferably produces an electric motorengine torque for the vehicle, and that can be monitored using methodsand systems disclosed herein.

FIG. 1 illustrates a vehicle 100, according to one embodiment of thepresent invention. The vehicle 100 includes a chassis 102, a body 104,four wheels 106, and an electronic control system 108. The body 104 isarranged on the chassis 102 and substantially encloses the othercomponents of the vehicle 100. The body 104 and the chassis 102 mayjointly form a frame. The wheels 106 are each rotationally coupled tothe chassis 102 near a respective corner of the body 104.

The vehicle 100 may be any one of a number of different types ofautomobiles, such as, for example, a sedan, a wagon, a truck, or a sportutility vehicle (SUV), and may be two-wheel drive (2WD) (i.e.,rear-wheel drive or front-wheel drive), four-wheel drive (4WD), orall-wheel drive (AWD), or another type of vehicle. The vehicle 100 mayalso incorporate any one of, or combination of, a number of differenttypes of engines, such as, for example, a gasoline or diesel fueledcombustion engine, a “flex fuel vehicle” (FFV) engine (i.e., using amixture of gasoline and alcohol), a gaseous compound (e.g., hydrogenand/or natural gas) fueled engine, a combustion/electric motor hybridengine (i.e., such as in a hybrid electric vehicle (HEV)), and anelectric motor.

In the exemplary embodiment illustrated in FIG. 1, the vehicle 100 is anHEV, and further includes an actuator assembly 120, a battery (or a DCpower supply) 122, a power converter assembly (e.g., an inverter orinverter assembly) 124, and a radiator 126. The actuator assembly 120includes a combustion engine 128 and an electric motor/generator (ormotor) 130.

Still referring to FIG. 1, the combustion engine 128 and/or the electricmotor 130 are integrated such that one or both are mechanically coupledto at least some of the wheels 106 through one or more drive shafts 132.In one embodiment, the vehicle 100 is a “series HEV,” in which thecombustion engine 128 is not directly coupled to the transmission, butcoupled to a generator (not shown), which is used to power the electricmotor 130. In another embodiment, the vehicle 100 is a “parallel HEV,”in which the combustion engine 128 is directly coupled to thetransmission by, for example, having the rotor of the electric motor 130rotationally coupled to the drive shaft of the combustion engine 128.

The radiator 126 is connected to the frame at an outer portion thereofand although not illustrated in detail, includes multiple coolingchannels therein that contain a cooling fluid (i.e., coolant) such aswater and/or ethylene glycol (i.e., “antifreeze”) and is coupled to theengine 128 and the inverter 124.

Referring again to FIG. 1, in the depicted embodiment, the inverter 124receives and shares coolant with the electric motor 130. However, otherembodiments may use separate coolants for the inverter 124 and theelectric motor 130. The radiator 126 may be similarly connected to theinverter 124 and/or the electric motor 130.

The electronic control system 118 is in operable communication with theactuator assembly 120, the high voltage battery 122, and the inverter124. Although not shown in detail, the electronic control system 118includes various sensors and automotive control modules, or electroniccontrol units (ECUs), such as an inverter control module, a motorcontroller, and a vehicle controller, and at least one processor and/ora memory which includes instructions stored thereon (or in anothercomputer-readable medium) for carrying out the processes and methods asdescribed below.

FIG. 2 is a functional block diagram of a motor control system andmethod 200 for a vehicle, such as the vehicle 100 of FIG. 1, inaccordance with an exemplary embodiment. In one preferred embodiment,the motor control system and method 200 operates in a motor torquecontrolled system. In another preferred embodiment, the motor controlsystem and method 200 operates in a torque regulated system. In stillother embodiments, the motor control system and method 200 may operatein a speed controlled system, among other possible variations.

As depicted in FIG. 2, the motor control system and method 200 consistsof multiple operations in a forward (or normal) control path 202 shownin FIG. 2 with solid lines. This preferably includes, but is not limitedto: obtaining measured inputs 206 from sensors, performing calculationson the measured inputs 206, receiving a torque command 208, processingthe torque command 208, generating a motor torque determination 210using the measured inputs 206 and the torque command 208, generating areference current 212 using the motor torque determination 210,converting the torque command 208 to current commands 214 based onpresent speed and available voltage and the reference current 212, andproviding current regulation 216 using the current commands 214. Theoutput of the current regulator performing the current regulation 216includes the voltage commands 218 for the output voltage needed toproduce the requested currents pursuant to the current commands 218.

A pulse width modulation (PWM) system is used for pulse width modulation220 by generating the necessary gate pulses or duty cycle commands 222,which are sent to the inverter hardware 224 stage to control an electricmotor 226 to the desired speed and/or torque as calculated in thecalculation block 228. The torque values (and/or other parameter values)for the electric motor 226 are preferably calculated in the calculationblock 228 using the inputs from the motor torque determination 210, thereference current 212 generation, the current regulation 216, and thepulse width modulation 220.

In addition, speed and/or position feedback 230, current feedback 232,and DC voltage 234 values are also preferably used in performingcurrent, position, and voltage calculations 233. The results of theposition feedback 230, current feedback 232, and DC voltage 234 valuesare provided for use in subsequent iterations of the motor torquedetermination 210, preferably also along with updated values of themeasured inputs 206 and the torque command 208. Additionalconsiderations may also be employed by the forward control path 202 suchas, by way of example only, system temperatures, system limitations, andadditional communications and/or or other feedbacks to the overallsystem control in terms of operating status and availability.

The forward control path 202 may also use any and all availableinformation and/or variables to produce and indicate an estimate of theoperating output, such as the electric motor torque as calculated in thecalculation block 228. In FIG. 2, this is shown as a torque calculationconsisting of estimating the torque being produced by the electric motorin the calculation block 228. However, as described above, in otherembodiments, vehicle speed and/or other parameter values may becalculated, instead of or in addition to the electric motor torque.

The control system and method 200 also include a monitoring flow path204 (also referenced herein as the monitoring path 204), depicted indashed lines in FIG. 2. In the depicted embodiment, the monitoring path204 includes two layers of monitoring, namely a first layer 237 and asecond layer 239.

In an exemplary embodiment, the first layer 237 of monitoring includesthe use of sensor monitors 235 for the individual sensors 205 providingthe measured inputs 206. For example, such sensor monitors 235 may beused to monitor whether the sensors 205 are turned on, and/or whetherthe sensors 205 are producing the measured inputs 206 within acceptableranges of values.

The second layer 239 of monitoring in the control system and method 200preferably processes all inputs and performs all calculationsindependently, utilizing separate memory and data storage areas. Thedistributed second layer 239 monitoring system performs an independentcalculation of the forward control path 202 and performs rationalizationwith the results of the forward control path 202 to verify that both theforward control path 202 and monitoring path 204 calculations are withina specified tolerance of one another.

The second layer 239 distributed monitor breaks the forward control pathinto small function blocks. The second layer 239 distributed monitorthen performs a monitoring function on each of the small functionalblocks independently. The small functional blocks are subsequentlycombined to form a complete loop of the control system.

In a preferred embodiment, the second layer 239 comprises monitoring ofall intermediate and final calculations of the control system and method200 as separate functional blocks independent of one another formonitoring purposes. Specifically, in the depicted embodiment, thesecond layer 239 includes a torque determination monitor 236, a currentreference monitor 238, a current regulation monitor 240, a pulse widthmodulation monitor 242, a torque calculation monitor 244, and aninput-based calculations monitor 246.

The torque determination monitor 236 provides monitoring of the motortorque determination 210. In one preferred embodiment, the motor torquedetermination 210 uses a first set of data from the measured inputs 206in determining the motor torque, and the torque determination monitor236 uses a redundant or second set of data from the measured inputs 206in providing redundant calculations of the motor torque for comparisonwith the motor torque determination 210. In another preferredembodiment, the torque determination monitor 236 provides backwardscalculations using the results of the motor torque determination 210 forcomparisons with the input data from the measured inputs 206 that wasused in the motor torque determination 210. In yet another preferredembodiment, the torque determination monitor 236 provides redundantcalculations of some or all of the calculations of the motor torquedetermination 210, and/or performs such calculations in a differentreference frame and/or during a different time period.

The current reference monitor 238 provides monitoring of the referencecurrent 212 generation. In one preferred embodiment, the referencecurrent 212 generation uses a first set of data from the measured inputs206 in determining the reference current, and the current referencemonitor 238 uses a redundant or second set of data from the measuredinputs 206 in providing redundant calculations of the reference currentfor comparison with the reference current 212 generation. In anotherpreferred embodiment, the current reference monitor 238 providesbackwards calculations using the results of the reference current 212generation for comparisons with the input data from the measured inputs206 that was used in the reference current 212 generation. In yetanother preferred embodiment, the current reference monitor 238 providesredundant calculations of some or all of the calculations of thereference current 212 generation, and/or performs such calculations in adifferent reference frame and/or during a different time period.

The current regulation monitor 240 provides monitoring of the currentregulation 216. In one preferred embodiment, the current regulation 216uses a first set of data from the measured inputs 206 in determining theregulated current, and the current regulation monitor 240 uses aredundant or second set of data from the measured inputs 206 inproviding redundant calculations of the regulated current for comparisonwith the current regulation 216. In another preferred embodiment, thecurrent regulation monitor 240 provides backwards calculations using theresults of the current regulation 216 for comparisons with the inputdata from the measured inputs 206 that was used in the currentregulation 216. In yet another preferred embodiment, the currentregulation monitor 240 provides redundant calculations of some or all ofthe calculations of the current regulation 216, and/or performs suchcalculations in a different reference frame and/or during a differenttime period.

The pulse width modulation monitor 242 provides monitoring of the pulsewidth modulation 220. In one preferred embodiment, the pulse widthmodulation 220 uses a first set of data from the measured inputs 206 indetermining the pulse width modulation, and the pulse width modulationmonitor 242 uses a redundant or second set of data from the measuredinputs 206 in providing redundant calculations of the pulse widthmodulation for comparison with the pulse width modulation 220. Inanother preferred embodiment, the pulse width modulation monitor 242provides backwards calculations using the results of the pulse widthmodulation 220 for comparisons with the input data from the measuredinputs 206 that was used in the pulse width modulation 220. In yetanother preferred embodiment, the pulse width modulation monitor 242provides redundant calculations of some or all of the calculations ofthe pulse width modulation 220, and/or performs such calculations in adifferent reference from and/or during a different time period.

The torque calculation monitor 244 provides monitoring of the torquecalculation block 228 (and/or any other calculations of the calculationblock 228 of FIG. 2). In one preferred embodiment, the torquecalculation block 228 uses a first set of data from the measured inputs206 in determining the torque calculation, and the torque calculationmonitor 244 uses a redundant or second set of data from the measuredinputs 206 in providing redundant calculations of the torque calculation(and/or any other calculations of the calculation block 228) forcomparison with the torque calculation block 228. In another preferredembodiment, the torque calculation monitor 244 provides backwardscalculations using the results of the torque calculation block 228(and/or any other calculations of the calculation block 228) forcomparisons with the input data from the measured inputs 206 that wasused in the torque calculation block 228. In yet another preferredembodiment, the torque calculation monitor 244 provides redundantcalculations of some or all of the calculations of the torquecalculation block 228 (and/or any other calculations of the calculationblock 228), and/or performs such calculations in a different referencefrom and/or during a different time period.

The input-based calculations monitor 246 provides monitoring of themeasured inputs 206 and/or the current, position, and voltagecalculations 233. In one preferred embodiment, the current, position,and voltage calculations 233 uses a first set of data from the measuredinputs 206 in determining the current, position, and voltage values, andthe input-based calculations monitor 246 uses a redundant or second setof data from the measured inputs 206 in providing redundant calculationsof the current, position, and voltage calculations 233 for comparisonwith the current, position, and voltage calculations 233. In anotherpreferred embodiment, the input-based calculations monitor 246 providesbackwards calculations using the results of current, position, andvoltage calculations 233 for comparisons with the input data that wasused in the torque calculation block 228. In yet another preferredembodiment, the input-based calculations monitor 246 provides redundantcalculations of some or all of the calculations of the current,position, and voltage calculations 233, and/or performs suchcalculations in a different reference from and/or during a differenttime period. In addition, in a preferred embodiment, the input-basedcalculations monitor 246 also monitors the measured inputs 206 overtime.

The results of the calculations of the torque determination monitor 236,the current reference monitor 238, the current regulation monitor 240,the pulse width modulation monitor 242, the torque calculation monitor244, and the input-based calculations monitor 246 are provided to asecond layer monitor health determination module 248 for processing. Thesecond layer monitor health determination module 248 includes aprocessor that compares the values from the various second layer 239monitoring path 204 modules (e.g., the torque determination monitor 236,the current reference monitor 238, the current regulation monitor 240,the pulse width modulation monitor 242, the torque calculation monitor244, and the input-based calculations monitor 246 are provided to asecond layer monitor health determination module 248) with correspondingvalues from corresponding modules of the forward control path 202 (e.g.,the motor torque determination 210, the reference current 212generation, the current regulation 216, the pulse width modulation 220,the torque calculation block 228, and the current, position, and voltagecalculations 233, respectively).

Specifically, in the depicted embodiment, the processor of the secondlayer monitor health determination module 248 calculates differences 250between the values from the various second layer 239 monitoring path 204modules and the corresponding values from the corresponding modules ofthe forward control path, and determines whether these calculateddifferences 250 are within acceptable ranges (step 252). If thedifferences are within acceptable tolerance ranges, then no remedialaction is required (step 254). Conversely, if one or more of thedifferences are not within acceptable tolerance ranges, then remedialaction is taken (step 256). Such remedial action may include, by way ofexample only, performing redundant calculations, providing warnings tousers and/or operators of the control system and method 200, shuttingdown part or all of the control system and method 200, and/or otherremedial measures. In addition, in certain embodiments, thedetermination in step 252 also includes a determination of whether thedifference is beyond an acceptable tolerance range for at least apredetermined length of time, and the remedial action (step 256) istaken only if the difference is beyond an acceptable tolerance range forat least the predetermined length of time.

In one preferred embodiment, the second layer 239 processes all inputsand perform all calculations independently, utilizing separate memoryand data storage areas. Then, the two calculations are compared to helpensure that they are identical and thus, that the calculations can beconsidered to be correct, or secured. However, this would duplicate therequired computing power and memory required, which may not always befeasible.

Alternatively, the independent calculations of the second layer 239 maycomprise functionally equivalent calculations or some form of backwardcalculations with the objective of verifying that the correct output ofthe module has been produced for the given inputs. In this case, theforward control path 202 and the monitoring path 204 calculations wouldneed to be within a specified tolerance of one another in order to beconsidered verified or secured.

In certain cases, it may be difficult to simplify the calculations toallow for a redundant, but functionally equivalent, calculation, withinthe processor throughput and memory constraints. Accordingly, in apreferred embodiment, the monitoring path 204 is run at a slower ratethan the normal or forward control path 202, so that any errors orfailures may still be detected.

Employing a multi-rate strategy is particularly effective when thesubsystem being monitored is executed very quickly when compared to thephysical characteristics of the system. For example, executing the motorcontrol functions every 50-100 microseconds when the torque response ofthe motor is on the order of 20-50 milliseconds would allow for failuredetection prior to an undesirable system output change. Additionaldetails of such a multi-rate strategy are provided in FIGS. 3-5 and aredescribed in greater detail below in connection therewith.

FIG. 3 is a graph of an exemplary sampling 300 of data from anelectronic control system over time, and that can be used in connectionwith the vehicle 100 of FIG. 1 and the motor control system and method200 of FIG. 2, in accordance with an exemplary embodiment. As depictedin FIG. 3, various sampling data is obtained over a number of samplinginstances 302, and monitoring calculations are performed over movingdetection windows 304 corresponding to the sampling instances using thesampling data obtained from respective sampling instances 302.

In the depicted embodiment, control path calculation results 306 arerepresented by the relatively small dots of FIG. 3. In a preferredembodiment, the fastest control cycle corresponds to the forward controlpath 202 of the control system and method 200 of FIG. 2. In oneexemplary embodiment, the control path calculations and correspondingcontrol path calculation results 306 of the fastest control cycle areperformed 100 microseconds apart. However, the timing of the controlpath calculations and corresponding results 306 of the fastest controlcycle may vary in other embodiments.

Also in the depicted embodiment, sampled monitor path calculationresults 308, 310 are represented by the relatively large dots of FIG. 3.Specifically, as depicted in FIG. 3, the large dots connected by thesmaller dots of FIG. 3 represent forward control path calculationresults 308 taken at the sampling instances 302 of FIG. 3, andpreferably corresponding to the forward control path 202 of FIG. 2.Conversely, the large dots connected by dashed lines in FIG. 3 representredundant or monitoring path calculation results 310 (preferablycorresponding to the monitoring path 204 of FIG. 2) calculated over themoving detection windows 304 using data from the sampling instances 302.

For illustrative purposes, the monitoring path calculation results 310are labeled in FIG. 3 as an exemplary first monitoring path calculationresult 312, second monitoring path calculation result 314, thirdmonitoring path calculation result 316, fourth monitoring pathcalculation result 318, fifth monitoring path calculation result 320,sixth monitoring path calculation result 322, seventh monitoring pathcalculation result 324, eighth monitoring path calculation result 326,and ninth monitoring path calculation result 328, each representingdifferent sampling instances 302 and corresponding sampling data frommoving detection windows 304, as referenced below. The dashed lineconnecting the monitoring path calculation results 310 is provided forillustration purposes only in order to indicate the continuity of themonitoring function.

The monitoring path calculations that generate the monitoring pathcalculation results 310 are conducted periodically, and less frequentlythan the forward control path calculations that generate the forwardcontrol path calculation results 308. In one exemplary embodiment, whilethe forward control path calculations that generate the forward controlpath calculation results 308 are conducted every 100 microseconds, themonitoring path calculations that generate the monitoring pathcalculation results 310 are conducted every five milliseconds, with eachfive milliseconds comprising one moving detection window 304. However,in other embodiments, the moving detection windows 304 may be of adifferent duration of time, among other possible variations. Forexample, in another exemplary embodiment for automotive hybrid systems,an interval or detection window of 200 microseconds may be utilized. Byperforming the monitoring path calculations that generate the monitoringpath calculation results 310 periodically, any corruption can bedetected in the interval or moving detection window 304 of interest toprevent an undesirable system response.

Four exemplary cases of interest are highlighted in the figure for thesampled monitor system. The first case, referring to the firstmonitoring path calculation result 312, shows that the monitoringfunction calculations produce a result which is of negligible differenceto the process being monitored, or is within the allowable differencebetween the calculations. For cases such as this, the process continues,and no remedial action is necessary.

The second case, referring to an intermediate instance in time 313during which a redundant or monitoring calculation result is notobtained, shows a case in which the monitoring function does not detectthe deviation in the intended process, for the reason that no samplingoccurs during the deviation. For cases such as this, any proactive faultresponse might occur from the primary monitoring function if suchcondition is beyond a predetermined threshold fault level. Otherwise,the process continues, and no remedial action is necessary.

The third case, referring to the second monitoring path calculationresult 314, shows that the monitoring function identifies a differentresult than the primary calculation path, but the condition exists foronly a short time (one sample in the presented figure) and does notexceed a level of concern. For cases such as this, the processcontinues, and no remedial action is necessary.

The fourth case, referring to the third monitoring path calculationresult 316, the fourth monitoring path calculation result 318, the fifthmonitoring path calculation result 320, the sixth monitoring pathcalculation result 322, the seventh monitoring path calculation result324, the eighth monitoring path result 326, and the ninth monitoringpath calculation result 328, indicates that a sustained differenceexists between the primary and monitoring path calculations. For casessuch as this, the process may be stopped in whole or in part, additionalredundant calculations may be performed, notifications of a possibleerror or fault may be provided, and/or other remedial action may beperformed.

Specifically, in one exemplary embodiment, a difference between arespective monitoring path calculation result 310 and a correspondingforward control path calculation result 308 is calculated using aprocessor, and is used as the quantity of interest for monitoringpurposes and for remedial action. If the difference exceeds apre-determined threshold in amplitude and/or duration within the movingdetection window, the monitoring function would indicate the conditionto the system controller.

In one exemplary embodiment, the detection of any difference ofsignificance (e.g. a difference between a respective monitoring pathcalculation result 310 and a corresponding forward control pathcalculation result 308) is of relatively higher importance. Also in anexemplary embodiment, once such a difference of significance isdetected, it is of lesser importance as to which path (if any) isproducing the correct calculations. In an exemplary embodiment, theforward control path calculation results 308 cannot be relied upon sincethey are dissimilar.

In addition, in one exemplary embodiment, the monitoring function mayindicate that a difference is significant if the monitoring pathcalculation results 310 differ from the corresponding forward controlpath calculation results 308 for some percentage of the time in one ormore moving detection windows 304. Also in an exemplary embodiment, themonitoring function may indicate that a difference is significant if themonitoring path calculation results 310 differ from the correspondingforward control path calculation results 308 for a predetermined lengthof time. The criteria (e.g., the magnitude of the threshold differencerequire and/or the threshold amount of time or percentage of timerequired to indicate an error or a failure) utilized for determiningwhether the difference is significant (i.e., in determining whetherthere is an error or a failure) may be dependent upon the process beingmonitored.

One important requirement of the sampled monitor system is that ofsynchronization. Because the monitor is performing redundant (orfunctionally equivalent) calculations utilizing separate memorylocations and comparing the results with the forward control path, it isnecessary that the data used for the calculations and comparisons arecoordinated in the appropriate time frame.

Consider the time frame of running the sampled monitor. If the fastestcontrol cycle (TaskZero) (i.e., for the forward control path 202 of FIG.2) is 100 microseconds while the sampled monitor (i.e., for themonitoring flow path 204 of FIG. 2) is run at five milliseconds(TaskFive), the sampled monitor calculations will take place in adistributed fashion over a portion of, or the entire five millisecondtask rate. As a result, the TaskZero control calculations will occurfifty times more frequently than the monitoring function calculations.If the monitor processes the inputs of the given TaskZero variables andcompares the results of the calculations to those corresponding to asubsequent TaskZero interval, the monitor may incorrectly indicate adiscrepancy resulting in a false fail condition.

Also in an exemplary embodiment, the monitor calculations for themonitoring flow path 204 of FIG. 2 are necessary to be distributed overthe TaskFive interval instead of being performed within the likeTaskZero period. For example, if the calculations were performed in thesame TaskZero interval, the monitor could severely load the processingsystems up to the point that the required calculations cannot becompleted within the required time frame.

FIG. 4 is a flowchart of a process 400 for monitoring electronic motorcontrollers for a vehicle, and that can be used in connection with thevehicle 100 of FIG. 1 and the motor control system and method 200 ofFIG. 2 and in implementing the data sampling 300 of FIG. 3, inaccordance with an exemplary embodiment. In the depicted embodiment, theprocess 400 includes the synchronization of data in the sampled monitorsystem, such as the sampling 300 of data of FIG. 3 for the controlsystem and method 200 of FIG. 2.

In a preferred embodiment, the process 400 is conducted separately byeach functional block of the second layer 239 of the monitoring path 204of FIG. 2 in concert with a corresponding functional block of theforward control path 202 of FIG. 2. Specifically, in a preferredembodiment, the process 400 is conducted separately by (i) the torquedetermination monitor 236 of FIG. 2 in concert with the motor torquedetermination 210 of FIG. 2; (ii) the current reference monitor 238 inconcert with the reference current 212 generation of FIG. 2; (iii) thecurrent regulation monitor 240 in concert with the current regulation216 of FIG. 2; (iv) the pulse width modulation monitor 242 in concertwith the pulse width modulation 220 of FIG. 2; (v) the torquecalculation monitor 244 in concert with the torque calculation block 228of FIG. 2; (vi) the input-based calculations monitor 246 of FIG. 2 inconcert with the current, position, and voltage calculations 233 of FIG.2, and any other functional blocks of the second layer 239 of themonitoring path 204 in concert with their corresponding functionalblocks of the forward control path 202 of FIG. 2.

FIG. 4 refers to three portions, components, or sub-processes of theprocess 400. A first component 500 comprises a TaskFive processorinterval sub-process 500, and preferably corresponds to a relativelyslower, monitoring processing path (most preferably the monitoring path204 of FIG. 2). A second component 600 comprise a task rate transitionsub-process 600, and preferably corresponds to a transition between therelatively slower, monitoring processing path (most preferably themonitoring path 204 of FIG. 2) and a relatively faster, controlprocessing path (most preferably the forward control path 202 of FIG.2). A third component 700 comprises a TaskZero rate interval sub-process700, and preferably corresponds to the relatively faster, controlprocessing path (most preferably the forward control path 202 of FIG.2). Preferably the various steps of the process 400 of FIG. 4 areperformed by a processor of the second layer monitor healthdetermination module 248 of FIG. 2 using data and measured inputs 206from the sensors 205 of FIG. 2.

For illustrative purposes, only two task rates are depicted in FIG. 4.Alternative embodiments may employ additional task rates involvingsimilar methods of synchronization between the task rate(s). The processbegins at step 510, in which the TaskFive rate calculations begin. Theprocess continues processing requested functions at step 520.

Then, at step 530, the process decides if the respective monitoringfunctions should be executed. Specifically, during step 530, the processevaluates the status of the DataFrozenFlag. In a preferred embodiment,the DataFrozenFlag is True (or, the DataFrozenFlag is in an activestate) if the control system and method 200 of FIG. 2 and/or first datathereof is ready for processing by the respective functional block ofthe forward control path 202 of FIG. 2. In one exemplary embodiment,this occurs at periodic points in time corresponding to the control pathcalculation results 306 of FIG. 3.

If the DataFrozenFlag status is determined to be False in step 530, thenthe process continues to process the forward control path functions atstep 560. In a preferred embodiment, during step 560, the calculationsof the respective functional block of the forward control path 202 ofFIG. 1 are performed.

Conversely, if the status of the DataFrozenFlag is determined to be Truein step 530, then the process proceeds instead to step 540, in which themonitor module is evaluated. In a preferred embodiment, during step 540,the monitor module functions are performed, and the process thencontinues to step 550, described below. Specifically, in one preferredembodiment, during step 540, the calculations of the respectivefunctional block of the monitoring path 204 of FIG. 1 are performed, andthe process then continues to step 550, described below.

During step 550, the status of the DataFrozenFlag is changed to False.The process then continues to step 560, in which additional functions ofthe forward control path are processed. Specifically, in one exemplaryembodiment, additional calculations of the respective functional blockof the forward control path 202 of FIG. 1 are performed during step 560.Alternatively, in another exemplary embodiment, calculations of adifferent functional block of the forward control path 202 of FIG. 1 maybe performed during step 560.

The process then continues to step 570. During step 570, the TaskFivetasks are completed. Specifically, in one exemplary embodiment, thecalculations of the respective functional block of the forward controlpath 202 of FIG. 1 are completed during step 570. In the exemplaryembodiment with only two task rates, the process cycles back to thebeginning, shown as step 580 returning to step 510, and the processrepeats.

In this example with two task rates, the TaskFive rate is thesupervisory process. In practice, the slower task rates may not beinteger multiples of the fastest control cycle. Because the fastestcontrol cycle sets multiple system properties, consumes the mostprocessing resources, and it typically highly dependent upon consistenttiming, the fastest control cycle (preferably, the forward control path202 of FIG. 2) takes priority over computation of slower control cycles(preferably, the monitoring path 204 of FIG. 2).

As a result, the fastest control cycle (preferably, the forward controlpath 202 of FIG. 2) is executed on a consistent basis while the slowercontrol cycles (preferably, the monitoring path 204 of FIG. 2) aredistributed over the remaining processor execution time. In terms ofthis example, the TaskZero control cycle (preferably, the forwardcontrol path 202 of FIG. 2) may begin, on a priority basis, at anyinstant during the TaskFive control cycle (preferably, the monitoringpath 204 of FIG. 2). Therefore, at any point during the TaskFive controlcycle (i.e., during the calculations of the monitoring path 204 of FIG.2, in a preferred embodiment), if a request to run the TaskZero controlcycle (i.e., the forward control path 202 of FIG. 2, in a preferredembodiment) is present, the process jumps from its present location inthe sub-process 500 to that of the transition sub-process 600.

At step 610, the processing of TaskFive control cycle (i.e., thecalculation of the monitoring path 204 of FIG. 2, in a preferredembodiment) ceases, and all variables of necessary intermediate data arestored for future use at step 620. The process then continues to thesub-process 700, which then executes the TaskZero process (i.e., thecalculations of the forward control path 202 of FIG. 2, in a preferredembodiment).

The TaskZero process (i.e., the calculations of the forward control path202 of FIG. 2, in a preferred embodiment) begins at step 710, andcontinues to process the requested functions of the TaskZero process atstep 720. Next, during step 730, a decision is made as to whethermonitoring path data and/or variables need to be stored for the monitormodules. This is determined by the status of the DataFrozenFlag,described above, in a preferred embodiment. As discussed above, in onepreferred embodiment, the DataFrozenFlag is deemed to be True, or to bein an active state, if control data is ready to be processed by theforward control loop 202 of FIG. 2, such as the case in periodicintervals of FIG. 3.

If it is determined in step 730 that the DataFrozenFlag is set to True,then no additional data needs to be saved for the monitor in the presentcontrol cycle. Accordingly, the process continues directly to step 760,described further below.

Conversely, if the DataFrozenFlag is set to False, then data and/orvariables need to be stored for use by the monitor module (i.e. themonitoring path 204 of FIG. 2, in one preferred embodiment).Accordingly, the process continues to step 740, in which the data and/orvariables required by the monitoring function (i.e., for thecalculations of the monitoring path 204 of FIG. 2, in a preferredembodiment) are stored in a memory for subsequent use by the monitoringfunction (i.e., for use by the monitoring path 204 of FIG. 2, in onepreferred embodiment). Following step 740, the process continues to step750. During step 750, the status of the DataFrozenFlag is set to True,indicating that a data storage event has occurred. The process thencontinues to step 760, described directly below.

During step 760, additional functions of the process are conducted. Inone preferred embodiment, additional calculations of the respectivefunctional block of the forward control path 202 of FIG. 2 are conductedduring step 760. Alternatively, in another exemplary embodiment,calculations of one or more additional functional blocks of the forwardcontrol path 202 of FIG. 2 may be conducted.

The process continues to step 770 and concludes the execution of theTaskZero process. Once the TaskZero calculations of the sub-process 700(i.e., the calculations of the respective functional block of theforward control path 202 of FIG. 2, in a preferred embodiment) isconcluded, the process jumps back to the transition portion of thesub-process 600. At step 630, the data and variables from the paused andinterrupted TaskFive system (i.e., from the monitoring path 204 of FIG.2, in one exemplary embodiment) are restored to active memory. Theprocess then preferably continues to step 640, in which the processresumes performance of the calculations of the TaskFive system of thesub-process 500 (i.e., of the monitoring path 204 of FIG. 2, in apreferred embodiment).

As depicted in FIG. 4, the setting of the DataFrozenFlag to True byTaskZero and the resetting of the DataFrozenFlag to False after thecompletion of the monitoring function module in TaskFive allows for asingle synchronized set of data to be used by the monitor module. In apreferred embodiment, the re-setting of the DataFrozenFlag in TaskFiveoccurs after the completion of the monitor module functions so the dataintegrity of the data being processed by the monitor module is preservedin the result of a request for the process to jump and process theTaskZero system. In one preferred embodiment, the data stored utilizingthe DataFrozenFlag comprises any information needed by the monitoringpath. This may include system or variable inputs and outputs. Integratorand/or derivative states of any regulators may also be needed in orderto process a redundant calculation.

FIG. 5 is a functional block diagram of a hierarchy 800 for the process400 of FIG. 4, and that can be used in connection with the vehicle 100of FIG. 1, the motor control system and method 200 of FIG. 2 and theimplementation of the data sampling 300 of FIG. 3, in accordance with anexemplary embodiment.

As depicted in FIG. 5, the hierarchy 800 includes various monitoringfunctions 801 and various corresponding control functions 802, alongwith the second layer monitor health determination module 248 of FIG. 2.In a preferred embodiment, the monitoring functions 801 correspond tothe various functional blocks of the second layer 239 of the monitoringpath 204 of FIG. 2, including the torque determination monitor 236 ofFIG. 2, the current reference monitor 238 of FIG. 2 (also referenced inFIG. 4 as a current determination monitor), the current regulationmonitor 240 of FIG. 2 (also referenced in FIG. 5 as a current controlmonitor), the pulse width modulation monitor 242 of FIG. 2, theinput-based calculations monitor 246 of FIG. 2, and the torquecalculation monitor 244 of FIG. 2.

Each of the monitoring functions 801 is coupled to a respective one ormore of the corresponding control functions 802. The control functions802 preferably correspond to the functional blocks of the forwardcontrol path 202 of FIG. 2, including the motor torque determination210, the reference current 212 generation, the current regulation 216,the pulse width modulation 220, the torque calculation block 228, andthe current, position, and voltage calculations 233. Also as depicted inFIG. 5, the hierarchy 800 may also include any other monitoringfunctions 801 (preferably corresponding to any other functional blocksof the second layer 239 of the monitoring path 204 of FIG. 2), alongwith corresponding control functions 802 (preferably corresponding toany other functional blocks of the forward control path 202 of FIG. 2).

In the depicted embodiment of FIG. 5, each of the monitoring functions801 (or functional blocks of the second layer 239 of the monitoring path204 of FIG. 2) are associated with a particular control function 802 (orfunctional block of the forward control path 202 of FIG. 2), and areindependent of one another. In order to determine the security of theoverall control system and method 200 of FIG. 2, the validitydetermination of each of the monitoring functions 801 is communicated tothe second layer monitor health determination module 248 as illustratedin FIG. 5.

The second layer monitor health determination module 248 (preferably, aprocessor thereof) processes the inputs from the plurality of monitoringfunctions 801 to determine whether the control system or method 200 ofFIG. 2, as a whole, is functioning as intended. In one preferredembodiment, the second layer monitor health determination module 248indicates a fault condition if one or more of the monitoring functions801 has indicated a non-secure output. For the exemplary application tothe hybrid electric vehicle motor torque monitor, the monitoring path204 monitors all aspects of the system torque production of the controlsystem and method 200. As a result, the system motor forward torquecontrol path 202 of FIG. 2 utilized in the electric motor torquegeneration is then secured by the monitoring flow path 204 of FIG. 2.

In the depicted embodiment, the monitoring functions 801 includemultiple control functions which can be partitioned into individualmodules. The processing of and order in which the modules are run arepredetermined by the hierarchy of the overall motor control system andmethod 200 of FIG. 2. For purposes of the sampled monitor system, eachcontrol module or functional block of the forward control path 202 ofFIG. 2 has its own monitoring function or functional block of themonitoring path 204 of FIG. 4 for the hierarchy 800 of FIG. 5. Each pairof control module and monitoring function is preferably linked byseparate DataFrozenFlags 804, as shown as DataFrozenFlag1 804 throughDataFrozenFlagN 804 in FIG. 5.

The use of separate DataFrozenFlags 804 provides an important benefit tothe sampled monitor system by effectively increasing the resolution ofthe sampled system. Due to the distributed processing of thecalculations at the TaskFive data rate, the various monitoring functionswill be sampling the forward control modules at different TaskZero timeperiods. Hence, any fault which would be able to propagate through thevarious control modules will have an increased detection opportunitycompared to using a single DataFrozenFlag for all of the controlmodules.

In order to determine the security of the overall motor controls system,the validity determination of each of the monitoring functions 801 iscommunicated to the second layer monitor health determination module248. The second layer monitor health determination module 248 processesthe inputs from the various monitoring functions 801 in order to confirmwhether the control system and method 200 of FIG. 2 are functioning asintended.

If the second layer monitor health determination module 248 determinesthat the control system is functioning properly, the control output andmonitoring process continue uninterrupted. Conversely, if the secondlayer monitor health determination module 248 determines that thecontrol system is not functioning properly, it takes the appropriateremedial action to prevent an undesired fault response. The remedialaction may include one or more of the following, among other possibleremedial action: system shutdown, system restart, communicating andindicating the fault detection, fault type and origin, and resultingfault action, or returning the controller to a default operating state.

While at least one exemplary embodiment has been presented in theforegoing detailed description, it should be appreciated that a vastnumber of variations exist. It should also be appreciated that theexemplary embodiment or exemplary embodiments are only examples, and arenot intended to limit the scope, applicability, or configuration of theinvention in any way. Rather, the foregoing detailed description willprovide those skilled in the art with a convenient road map forimplementing the exemplary embodiment or exemplary embodiments. Itshould be understood that various changes can be made in the functionand arrangement of elements without departing from the scope of theinvention as set forth in the appended claims and the legal equivalentsthereof.

What is claimed is:
 1. A method for controlling an electrical system ofa vehicle using first data for a first path of calculations and seconddata for a second path of calculations, the first path comprising afirst plurality of calculations of generating a value of a parameterpertaining to the electrical system, the second path comprising a secondplurality of calculations of monitoring the electrical system withrespect to the first path, and the method comprising the steps of:determining whether the first data is ready for processing along thefirst path using a processor; performing calculations of the first pathusing the first data and the processor; performing calculations of thesecond path using the processor and the second data if the first data isnot ready for processing along the first path, wherein: the step ofperforming calculations of the first path comprises performing thecalculations of the first path via time sampling at a first rate via theprocessor; and the step of performing calculations of the second pathcomprises performing calculations of the second path via time samplingat a second rate via the processor, the second rate being different fromthe first rate.
 2. The method of claim 1, wherein the step of performingthe calculations of the second path comprises the step of performingredundant calculations of the first plurality of calculations using thesecond data and the processor to thereby generate a redundant value ofthe parameter.
 3. The method of claim 1, wherein the step of performingthe calculations of the second path comprises the step of performing abackward calculation from the value of the parameter to generate aderived input value using the processor.
 4. The method of claim 1,wherein the step of performing calculations of the first path comprisesthe step of processing a plurality of requested functions for use indetermining the value of the parameter using the processor if the datais ready for processing along the control path.
 5. The method of claim1, wherein the step of determining whether the data is ready forprocessing along the first path comprises the step of determiningwhether a data frozen flag is active using the processor.
 6. The methodof claim 5, wherein the step of performing the calculations of thesecond path comprises the steps of: performing the calculations of thesecond path using the processor and the second data so long as the datafrozen flag is active; and setting the data frozen flag to inactive ifthe first data becomes ready for processing at any time during theperforming of the calculations of the second path.
 7. The method ofclaim 6, wherein the step of performing the calculations of the secondpath comprises the steps of: storing results of the calculations of thesecond path using the processor upon completion of the calculations ofthe second path; and setting the data frozen flag to inactive using theprocessor upon completion of the calculations of the second path.
 8. Themethod of claim 7, further comprising the steps of: storing preliminaryresults from the calculations of the second path using the processor ifthe first data becomes ready for processing at any time during theperforming of the calculations of the second path; and returning toperforming the calculations of the first path using the processor uponstoring the preliminary results if the first data becomes ready forprocessing at any time during the performing of the calculations of thesecond path.
 9. The method of claim 1, wherein: the step of determiningwhether the data is ready for processing along the first path comprisesthe step of determining whether a plurality of data frozen flags areactive using the processor, each of the plurality of data frozen flagscorresponding to a respective one of the first plurality of calculationsof the first path and a respective one of the second plurality ofcalculations of the second path; the step of performing the calculationsof the first path comprises the step of performing those of the firstplurality of calculations for which the corresponding data frozen flagis inactive using the processor; and the step of performing thecalculations of the second path comprises the step of performing thoseof the second plurality of calculations for which the corresponding datafrozen flag is active using the processor.
 10. A method for controllingan electrical system of a vehicle using control data for a control pathof a first plurality of calculations of the electrical system andmonitoring data for a monitoring path of a second plurality ofcalculations for monitoring the control path, the method comprising thesteps of: determining whether a plurality of data frozen flags areactive using a processor, each of the plurality of data frozen flagscorresponding to a respective one of the first plurality of calculationsof the first path and a respective one of the second plurality ofcalculations of the second path; performing those of the first pluralityof calculations for which the corresponding data frozen flag is inactiveusing the processor; performing those of the second plurality ofcalculations for which the corresponding data frozen flag is activeusing the processor; storing results of the second plurality ofcalculations upon completion of the second plurality of calculations;and setting the data frozen flag to inactive using the processor uponcompletion of the second plurality of calculations.
 11. The method ofclaim 10, further comprising the steps of: generating a plurality ofvalues from the first plurality of calculations of the control pathusing the processor; and generating a plurality of redundant values fromthe second plurality of calculations of the monitoring path, each of theplurality of redundant values corresponding to a respective one of theplurality of values using the processor.
 12. The method of claim 10,further comprising the steps of: generating a plurality of values fromthe first plurality of calculations of the control path using theprocessor; and performing a plurality of backward calculations from theplurality of values to generate a plurality of derived input valuesusing the processor.
 13. The method of claim 10, further comprising thesteps of: storing preliminary results from the second plurality ofcalculations using the processor if the corresponding data frozen flagsbecome inactive at any time during the performing of the correspondingsecond plurality of calculations; and returning to performing the firstplurality of calculations using the processor if the corresponding datafrozen flags become inactive at any time during the performing of thecorresponding second plurality of calculations.
 14. A system forcontrolling an electrical system of a vehicle, the system comprising: aplurality of sensors used to obtain first data for a first path ofcalculations and second data for a second path of calculations, thefirst path comprises a first plurality of calculations of generating avalue of a parameter pertaining to the electrical system, the secondpath comprises a second plurality of calculations of monitoring theelectrical system with respect to the first path; and a processorcoupled to the plurality of sensors and configured to: determine whethera data frozen flag is active; perform the first plurality ofcalculations of the first path using the first data if the first dataflag is inactive; and perform the second plurality of calculations ofthe second path if the first data flag is active.
 15. The system ofclaim 14, wherein the processor is further configured to performredundant calculations of the first plurality of calculations using thesecond data to thereby generate a redundant value of the parameter. 16.The system of claim 15, wherein the processor is further configured to:perform the second plurality of calculations of the second path usingthe second data so long as the data frozen flag is active; and set thedata frozen flag to inactive if the first data becomes ready forprocessing at any time during the performing of the second plurality ofcalculations of the second path.
 17. The system of claim 16, wherein theprocessor is further configured to: store results of the secondplurality of calculations of the second path upon completion of thesecond plurality of calculations of the second path; and set the datafrozen flag to inactive using the processor upon completion of thesecond plurality of calculations of the second path.
 18. The system ofclaim 17, wherein the processor is further configured to: storepreliminary results from the second plurality of calculations of thesecond path if the first data becomes ready for processing at any timeduring the performing of the second plurality of calculations of thesecond path; and return to performing the first plurality ofcalculations of the first path upon storing the preliminary results ifthe first data becomes ready for processing at any time during theperforming of the second plurality of calculations of the second path.19. The system of claim 14, wherein the processor is further configuredto perform a backward calculation from the value of the parameter togenerate a derived input value using the processor.